Che Telegraph 


TELEGRAPH MEDIA GROUP LIMITED 
RESPONSE TO THE ICO’S AGE APPROPRIATE DESIGN CODE CONSULTATION 


Overview 


Telegraph Media Group Limited — publisher of The Daily Telegraph, The Sunday Telegraph, 
telegraph.co.uk and other digital products - is a leading provider of high quality journalism in 
the UK and globally. 


We are members of the News Media Association and of Internet Advertising Bureau UK, and 
endorse their respective submissions to the ICO. In its current form, the draft Age 
Appropriate Design Code could wreak havoc upon the news media and threatens legitimate 
and lawful use of data for advertising purposes. It has a potentially wide and damaging 
impact on ad-funded content and services. 


The Code seeks to apply to all information society services with UK based establishments 
which are likely to appeal to or be accessed by children, even if not the intent of the service. 
These include search engines, social media platforms, online messaging systems, online 
marketplaces, content streaming services (video, music, gaming), news, education 
websites, and any websites offering other goods or services over the internet.* 


There are limited exclusions. The Code will not apply to: 


e Small businesses, but there is little guidance to help identify what qualifies as a 
small business. 


e Services that are not accessed by a “significant” number of children. There is no 
indication as to the meaning of significant number, but, the draft Code shall apply 
even if only a small proportion of the users are children. 


The age range of persons defined as “children” for the purpose of the draft Code spans from 
children of pre-literate and early literacy ages (0-5 years) to children under the age of 18 
years. Yet, the GDPR expressly provides that processing of personal data of a child shall be 
lawful where a child is at least 16 years old, and that member states can provide for a lower 
age not below 13 years.* In the UK, that age is 13 years.’ 


Given the broad age range, it will be almost impossible for many UK based websites to 
demonstrate that less than a significant number of children access its services. If 
businesses do not know which users are children, businesses are required to apply the 
Code to all users.* In practice, for many businesses this will mean the highest privacy 
settings and content tailored to the lowest age group (0-5 years). 


Statistics published by the Department of Education® show that in 2018, English is a second 
language for 49% of students in London primary schools and 41% for London secondary 
schools. Aggregated across England, English is a second language for 21% of 4.7 million 
primary school students and 17% of 3.25 million secondary school students. This indicates 
that significant numbers of children that will be accessing all types of websites, if nothing 
more, than for the purpose of assisting their parents, who may not be English speakers. 


In the case of UK news websites, children under the age of 18 years will access content 
based upon their interests, be it sports, fashion, travel, entertainment, celebrity, the Royal 


1 Draft Age Appropriate Design Code Version 1.0 for public consultation (15/04/2019-31/05/2019) page 12 (Draft AADC) 
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Family, as well as more hard hitting news, such as politics and business. In the UK overall, 
national newspapers are syndicated through NLA Media Access (a news industry licensing 
body) to approximately 28,000 schools and over 7.6 million students. News content is used 
in exam papers, complementing the government’s own media literacy programme. 


This means that the Code will apply to the websites of UK news publishers, unless children 
are barred from their online services. 


The crude application of the Code to multitudes of UK-based online businesses, including 
news publishers, and the principle requirements to put the best interests of the child as a 
primary consideration® and tailor services to the different needs of children at different ages 
and stages of development, at the heart of the design of the service,’ is unworkable for 
many businesses. 


The Code goes beyond the regulatory remit of the ICO. It blatantly spurns the carefully 
debated and drafted principles of GDPR that state that the fundamental right of privacy is not 
absolute and needs to be balanced against other fundamental rights, in accordance with the 
principle of proportionality.2 The Code gives undue priority to the fundamental right of data 
protection over the fundamental rights of freedom of expression and information and 
freedom to conduct a business. It is shamefully disproportionate and does not account for 
the nature, scope, context and purpose of processing as well as the risks of varying 
likelihood and severity for the rights and freedoms of natural persons.’ 


The Code will not apply to broadcast services, *° such as the BBC, Sky, ITV, Channel 4 and 
others. And, the Code will not apply to non-UK based establishments that are under the 
remit of a lead supervisory authority outside the UK, and not the UK Information 
Commissioner’s Office. This means that the large players, such as Google, Facebook, 
Amazon, Apple, Snapchat, Netflix and others, would not have to comply, unless they choose 
to be regulated by the UK Information Commissioner’s Office as their lead data protection 
regulator. 


The application of the Code to UK based establishments places onerous burdens on 
legitimate UK businesses and reinforces market conditions that, in the case of UK news 
publishers, already strongly favour large non-UK based international players and the 
publically funded broadcast news. 


Specifically for non-broadcast UK news publishers, there are a number of serious 
implications. 


The requirement to apply the highest privacy settings to services means unless a news 
publisher implements robust age-verification mechanisms, it will be effectively precluded 
from undertaking its normal business including: serving personalised advertising, contextual 
advertising, personalised content, performance monitoring of its content and effectiveness of 
advertising, audience measurement, data analytics to help develop its content strategy and 
so forth. 


Unless able to exclude children from our service, the requirements to put the best interests 
of the child as a primary consideration’ and tailor the service to the different needs of 
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children at different ages and stages of development, at heart of the design,** mean that UK 
news publishers would need to: 


° censor the news to such an extent as to inhibit ordinary news reporting, on the basis 
that a number of children ranging from 0-17 years of age may access it, in order to 
protect and support their well being, to protect and support their physical, 
psychological and emotional development. 


° publish different versions of the news for the different age groups on a daily (or more 
frequent) basis, in order to recognise the evolving capacity of the child to form their 
own view, and give due weight to that view. This could mean the displaying news 
in video and cartoon formats for children between the ages of 0—5 years, even if 
there is little likelinood of those children accessing news content. 


Consequently, the online content of news publishers which is intended for the public at large 
will need to comply with the standards of the Code which are more appropriate to pre-school 
than a national newspaper. These restrictions do not apply to the printed newspaper. 


The requirement to dumb-down the news in order to comply with the Code is contrary to the 
fundamental right of freedom of expression and cuts across the government’s media literacy 
initiatives. It would curtail our ability to (1) report on controversial issues, criminal activity, 
murders, sexual exploitation, terrorism and so on, which may be distressing, with particular 
impact on younger children;*® and (2) publish opinion pieces and politically biased news, 
because it may not meet the Code’s requirement to respect the right of the child to freedom 
of thought, conscience and religion.*” Yet, in the long term, such curtailment would also be 
harmful to a child’s own education, development and media literacy. 


The Code fails to give due regard to the fundamental right of freedom of expression. High 
quality journalism is of fundamental importance to a healthy democracy,*® as is a diverse 
media. Whilst UK broadcasters are bound by requirements for impartiality,"° the press is not 
required to be politically impartial and can offer a “greater diversity of viewpoints and 
opinions”.*° 

With falling revenues, news publishers rely on innovative initiatives to increase their 
revenues and to increase user engagement. “The value of an ad targeted with data that 
picks out the people it is most likely to influence is worth at least two to three times as much 
as one where there is no such data.”** Furthermore, the collection of data is critical for the 
development of subscription based revenue models. 


The indiscriminate and blunt application of the Code in its current form, with abysmal 
disregard for the protections set out in the GDPR for freedom of expression and information 
and for freedom to conduct legitimate businesses is harmful to UK news publishers. 


UK news publishers are already facing a number of challenges from the BBC, Google and 
Facebook, amongst others. The Code will operate effectively as a regulatory ad blocker, 
which would detrimentally impair the ability of UK news publishers to have meaningful 
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engagement with their audiences and to earn revenues through advertising. It will be a 
threat to the sustainability of UK news publishers and media plurality and put more influence 
in the hands of these other players. 


The Code’s unapologetically strong bias against freedoms of expression, of information and 
of business fails to meet government's vision for a free, open and secure internet, freedom 
of expression online, and a thriving UK digital economy, with a prosperous ecosystem of 
companies developing innovation in online safety.** It runs the risk of driving legitimate 
online businesses off-shore and thwarting innovation in the UK. 


The presumption under the Code is that businesses which are otherwise GDPR compliant 
but have not met the disproportionate standards of the Code will be prima facie in breach of 
GDPR and businesses will need to justify and provide compelling reasons which take into 
account the best interests of the child merely for operating according to legitimate business 
norms. This is a reversal of the onus that strikes against the long established foundations of 
British justice. 


Children do not need to be protected from the news or legitimate news websites per se. 
Many UK news publishers have an editorial duty of care and observe the self regulatory 
codes published by the Independent Press Standards Organisation and the Committee of 
Advertising Practice, which include content guidelines for the protection of children. 


However, children do need protection from what they may be accessing online via search 
engines, such as the more patently harmful child grooming and pornography websites and 
from the more innocuous social media platforms and content sharing platforms, which may 
not be adequately moderated for online child safeguarding purposes. Many of these are 
likely to be regulated by a lead supervisory authority outside of the UK and therefore beyond 
the remit of UK Information Commissioner’s Office and beyond the purview of this Code. 


22 DCMS Online Harms Paper, April 2019, para 12 
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Specific Comments on the proposed Standards 


Age Verification Mechanisms and High Privacy by Default 


GDPR states that children merit specific protection in respect of services offered directly to 
children. The Code goes beyond this. It requires businesses to apply the highest privacy 
settings to its services unless the business is able to implement robust age-verification 
mechanisms upfront to confirm the ages of each user.” 


The Code acknowledges that there are no recognised age verification systems available.” 
The requirement to implement high privacy settings by default*® also precludes businesses 
from applying data analytics to infer the ages of users without their prior consent. And 
asking users to self declare does not amount to robust age verification.” 


Without a robust age verification mechanism, news publishers would be required to request 
users to provide a passport or a similar identity document in order for news publishers to be 
able to serve advertising to that user. Not only would this be an excessive request that 
would drive users to other sources of news, save for age verification purposes, the 
requirement for news publishers to process passport or other identity documents would 
contravene the GDPR and the Code’s requirements for data minimisation. 


Meeting the requirements of the Code in its current form is unattainable for UK news 
publishers. The alternative may be to put the news behind a paywall. However, “if the UK 
moves towards a market where newspapers are increasingly available only behind a 
paywall, it will leave those with lower incomes with fewer quality news sources. This 
evidence suggests that there is a real divide in the news available to people of different 
socioeconomic backgrounds, creating a democratic gap in news engagement.””® 


Best Interests of the Child and Age Appropriate Design 


The Code has classified the different age groups as follows: 


0-5 Pre-literate and early literacy 
6-9 Core Primary School Years 
10-12 Transition years 

13-15 Early teens 

16-17 Approaching adulthood 


Unless we are able to prevent children from accessing our services, in respect of each of the 
different age groups, the standards in the Code require businesses to: 


e protect and support their well being, 

e to protect and support their physical, psychological and emotional development,” 

e recognise the evolving capacity of the child to form their own view, and give due 
weight to that view,” 

e respect the right of the child to freedom of thought, conscience and religion,” 
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and so forth. This would mean UK news publishers would have to censor and to tailor its 
online news to the different needs of children at each of the different ages and stages of 
development set out above.*? This may include creating videos or cartoons for 0-5 year old 
children, even if the likelihood of this particular age group accessing our service may be 
negligible. None of this is workable for a daily news publisher. 


UK news publishers should not be required to censor the news based upon the Code’s 
prescribed age groups. 


Compliance by UK news publishers with the self-regulatory codes published by the 
Independent Press Standards Organisation and the Committee of Advertising Practice is 
sufficient. The ICO is not and should not use the Code to become a defacto content 
regulator. 


Nudge Techniques 


The Code precludes the use of techniques that would “nudge” a user towards the service 
provider’s preferred option.” This would mean that businesses would not be able to use 
personal data to encourage a user to complete a transaction, for example, abandoned 
shopping baskets, or, in the case of a news publisher, to complete the purchase of a 
subscription following a free trial period. Nor could UK news publishers use personal data to 
drive content and personalise the news and increase user engagement with its website 
content. Nudge techniques are also used to verify whether or not a failure to complete a 
transaction is due to a technical glitch, or an unintended oversight by the user. 


Prohibition on nudge techniques for legitimate purposes is seriously detrimental to the 
business of online news publishers. 


Detrimental Use of Data 
The Code suggests that strategies to extend user engagement should be precluded. 


The financial sustainability of news publishers is dependent upon extending user 
engagement and enhancing the value of our advertising inventory through targeted 
advertising. 


Data Sharing 


The high data privacy settings required by the Code means that businesses would need to 
cease all data sharing, including the most basic data processing, such as the use of cloud 
servers or third party customer data technology specialists, unless there is a compelling 
reason to do so, taking into account the best interests of the child. 33 


The Code provides that “a clear example of a compelling reason is data sharing for safe 


guarding purposes, or the purposes of preventing or detecting crimes against children, such 


as online grooming”,*° which is already permitted under GDPR.*’ 


% Draft AADC, Best Interest of the Child, Age Appropriate Design, pages 17-27 

33 Draft AADC, 12" Standard, Nudge Techniques, Pages 67-72 

% Draft AADC, 4" Standard, Detrimental use of data, Pages 37-38: Until such time as a formal position is adopted you should 
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However, the Code gives no indication as to whether ordinary, legitimate business practices, 
for example, the use of cloud servers or third party data processors, such as customer data 
technology specialists, would be adequately compelling. 


This means that although GDPR permits businesses to share data, providing that the 
appropriate data processing provisions and protections in place, the Code requires further 
compelling justification to use third party data processors, even if already compliant with 
GDPR. 


This is unrealistic and fails to respect the GDPR requirement to balance privacy rights with 
other fundamental rights, including freedom to conduct a business. *° 


Parental Controls, Governance and Accountability 
The Code requires businesses to: 


e put into place an accountability programme to effectively address the standards in the 
Code, and to assess and revise the programme on an ongoing basis, building changes 
to reflect the changing environment of children’s privacy; and 


e to implement parental controls, which although not specifically stated to be mandatory, 
would be a required measure if a business was to meet the standard of putting a child’s 
best interest as a primary consideration as central of the design and development on 
online services. This would mean that the business would also be required to provide 
age appropriate information to children so that children, in the different age groups, know 
that parental controls are in place and educate parents as to the child’s right of privacy. 


These standards are not appropriate to news publishers that provide an online news service 
for the general public, not specific to children. The Code does not provide any latitude for 
taking into account the nature, scope, context and purpose of processing nor the risks of 
varying likelihood and severity for the rights and freedoms of natural persons, as is provided 
for under GDPR.*? 
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